Which of the following is MOST likely to take place during the containment phase of incident response?

The correct answer is D. Notifying stakeholders affected by the incident. The incident response lifecycle phases are: Preparation → Identification → Containment → Eradication → Recovery → Lessons Learned. During containment, the incident has been confirmed and the focus shifts to limiting damage and communicating with affected stakeholders. Root…

Submitted by fernanda_arg· Apr 18, 2026Information Security Incident Management

Question

Options

APresenting a root cause analysis report
BRestoring critical systems
CConfirming the incident
DNotifying stakeholders affected by the incident

How the community answered

(39 responses)

A
3% (1)
B
5% (2)
C
3% (1)
D
90% (35)

Explanation

The incident response lifecycle phases are: Preparation → Identification → Containment → Eradication → Recovery → Lessons Learned. During containment, the incident has been confirmed and the focus shifts to limiting damage and communicating with affected stakeholders. Root cause analysis (A) occurs in the Lessons Learned phase. Restoring critical systems (B) is Recovery. Confirming the incident (C) belongs to the Identification phase. Notifying stakeholders is a standard containment-phase activity.

Topics

#Incident Response Phases#Containment#Stakeholder Communication#Incident Management Process

Community Discussion

No community discussion yet for this question.

Full CISM Practice